Argo Workflows (Argo Server, SSO RBAC delegation gatekeeper): With SSO_DELEGATE_RBAC_TO_NAMESPACE enabled, an SSO user

Impact

With SSO_DELEGATE_RBAC_TO_NAMESPACE enabled, an SSO user whose claims match a namespace RBAC rule but no SSO-namespace rule triggers a nil dereference and panics the request path. Low impact on its own, but it is a login-time crash, so the users it affects cannot reach the workflow UI or API at all.

Who can reach it

An authenticated SSO user whose group or claim mapping exists in a tenant namespace but not in the SSO namespace. Requires the operator to have turned on RBAC delegation.

What to do

Upgrade Argo Server to 4.0.5 and restart. As an interim measure either disable SSO_DELEGATE_RBAC_TO_NAMESPACE or ensure every delegated namespace rule has a matching rule in the SSO namespace.

References